<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=0.5">
  <title>HSTS Preload List Removal</title>
  <link rel="shortcut icon" href="/favicon.ico">
  <link rel="apple-touch-icon" href="/static/app-icon.png">

  <link rel="stylesheet" href="/static/css/style.css">
  <link rel="stylesheet" href="/static/css/form.css">
  <link rel="stylesheet" href="/static/css/github.css">
  <script src="/static/js/base.js"></script>
  <script src="/static/js/view.js"></script>
  <script src="/static/js/form.js"></script>
  <script>
    window.addEventListener('load', function() {
      new Form(RemovalController);
    });
  </script>
</head>
<body class="theme-remove">
<a class="github-fork-ribbon" href="https://github.com/chromium/hstspreload.org" data-ribbon="On GitHub" title="On GitHub">On GitHub</a>

<div class="content form">
  <section id="removal-form">
    <form id="domain-form" class="hidden">
      <h2><label for="domain">
        Enter a domain to remove from the HSTS preload list:
      </label></h2>

      <input id="domain" name="domain" type="text" placeholder="example.com"
        autocorrect="off" autocapitalize="off" spellcheck="false">
      <br>
      <input id="check" type="submit" value="Check eligibility for removal">

    </form>

    <!-- We un-hide the form using inline JS so that (when JS is enabled)
         it shows in the normal rendering order as if it was never hidden. -->
    <script>document.getElementById("domain-form").classList.remove("hidden");</script>
    <noscript>This form requires JavaScript.</noscript>
  </section>

  <div id="result-waiting" class="result hidden">
    <p><span id="checking"></span><span id="spinner" class="spinner"></span></p>
  </div>

  <div id="result" class="result hidden">
    <p id="status"></p>
    <p id="summary"></p>
    <div id="issues-wrapper"></div>
  </div>

  <form id="submit-form" class="hidden">
  <hr>
    <h2>Remove</h2>
    <input id="submit" type="submit" disabled
       value="Submit to the HSTS preload list">
    <div id="submit-success" class="submit-feedback hidden">
      <hr>
      <h2>Successful Removal</h2>
        <p><code class="domain-text">example.com</code> is now pending removal from the HSTS preload list.
        </p>
        <p>Please make sure that <code class="domain-text">example.com</code> never sends an HSTS header with the <code>preload</code> directive, unless you are ready to preload again.</p>
        <p>Good luck with HSTS in the future!</p>
    </div>
    <div id="submit-failure" class="submit-feedback hidden">
      <hr>
      <h2>Failure</h2>
      An error occurred. Please start over.
    </div>
  </form>
</div>

<div class="content">
  <section id="information">
    <h2><a class="hash-link" href="#information">Information</a></h2>
    <p>
      This form can be used to remove domains from the <a href="/">HSTS preload list</a>.
    </p>
  </section>
  <section id="removal-requirements">
    <h2><a class="hash-link" href="#removal-requirements">Removal Requirements</a></h2>
    <p>
      If a preloaded site sends a valid HSTS header <strong>without</strong> the <code>preload</code> directive, it is considered to be requesting removal from the preload list.
    </p>
    <p>
      In order to be removed from the HSTS preload list through this form, your site must demonstrate the removal request by satisfying the following set of requirements:</p>
    <ol>
      <li>Be <strong>preloaded</strong> or <strong>pending preload</strong> through <code>hstspreload.org</code>.</li>
      <li>Serve HTTPS with a <strong>valid certificate</strong>.</li>
      <li>Send a <strong>valid HSTS header</strong>.
        <ul>
          <li>The header must <strong>not contain the <code>preload</code> directive</strong>.</li>
        </ul>
      </li>
    </ol>
    <p>
      Please note that a preload list domain removal may take 6-12 weeks to reach most Chrome users, and may take longer for other browsers.
    </p>
  </section>

  <section id="disabling-hsts">
    <h2><a class="hash-link" href="#disabling-hsts">Disabling HSTS</a></h2>

    <p>
      If you completely want to disable HSTS, you can send the following <a href="https://blog.mozilla.org/security/2012/11/01/preloading-hsts/">knockout entry</a>:
    </p>

    <code class="header-example">Strict-Transport-Security: max-age=0</code>

    <p>
      If you want to be removed from the preload list but do not completely want to disable HSTS, it is up to you whether you would like remove the <code>includeSubDomains</code> directive or change the <code>max-age</code> value, as long as you remove the <code>preload</code> directive.
    </p>
  </section>
</div>

</body>
</html>
